Server signed Actor Delete activities

[mediaformat]

Pitch

Allow Actor Delete activities to be signed by an Instance actor

the Delete activity may be signed by the remote server's Instance actor instead of the actor itself.

https://swicg.github.io/activitypub-http-signature/#handling-deletes-of-actors

Motivation

Allowing an Application actor to sign & send Actor Delete activities, the sending server could potentially group deleted Actors in the object thereby reducing some of the chatter this activity causes.

The receiving server could verify that the Actor(s) has indeed been Deleted, resulting in 404 or 410.

See:

• Addressing and Delivery of Delete Activities #23175
• Add/User Delete activities Automattic/wordpress-activitypub#552

[trwnh]

One problem is that there is no indication that any given actor has the authority to delete another, different actor. You could get around this by saying that every actor is attributedTo the server (or some actor representing it), but on its own, a Delete is only valid if its object is owned by the actor.

[mediaformat]

What about if the actor was somehow designated as such, for example in node-info, or some other server authoritative way?

[mediaformat]

There is already extensive discussion re: FEP-2677 seeking to formalize this very thing!

Also a draft PR